Broken authentication

When authentication functions that help to authenticate users to the application are not implemented correctly, that may allow hackers to compromise passwords or session IDs, or to exploit other implementation flaws using other users' credentials. These types of flaws are known as broken authentication.

We can use mechanize scripts to check the authentication mechanism in an application.

With this, we have to check the account management functions like account creation, change password, and recover password. We could also write customized brute-force and dictionary attack scripts to check the login mechanism of the application.

We can generate all possible passwords with a range of characters in them as follows:

# import required modules
from itertools import combinations  
 
from string import ascii_lowercase 
 
# Possible password list 
 
passwords = (p for p in combinations(ascii_lowercase,8)) 
 
for p in passwords: 
...